{
  "slug": "2026-11-09",
  "date": "2026-11-09",
  "updated": "2026-11-10",
  "title": "Run VoIP or a PBX? Patch FreeSWITCH now",
  "intro": "Criminals are already exploiting a critical flaw in FreeSWITCH, open source software that powers many phone systems and sits behind some providers' hosted VoIP and contact-centre platforms. If you run your own phone system, or use a hosted VoIP or PBX provider, this is the one item to act on this week.",
  "quietWeek": false,
  "items": [
    {
      "id": "freeswitch-sip-message-rce",
      "rank": 1,
      "published": "2026-11-09",
      "title": "Use VoIP or a PBX phone system? It needs a patch now",
      "summary": "FreeSWITCH, open source software that powers many business phone systems and sits behind some providers' hosted VoIP (voice over the internet) and contact-centre platforms, has a critical flaw. Criminals are already using it: a single crafted message sent to the phone system can run commands on the underlying server, including stealing call credentials, listening in on or redirecting calls, and running other commands on the machine. On many default setups no valid login is needed. The software maker fixed this in version 1.11.3, released in August 2026.",
      "whoItAffects": "Businesses that run their own phone system or PBX built on FreeSWITCH, and anyone using a hosted VoIP or contact-centre provider that runs it behind the scenes, worth checking even if you don't manage the system yourself. If your phone system is a mainstream service like Microsoft Teams Phone or a telco-branded VoIP plan, this generally isn't yours to worry about directly.",
      "action": "Ask whoever manages your phone system: \"Are we running FreeSWITCH, directly or through our VoIP or PBX provider, and has it been updated to version 1.11.3 or later?\"",
      "prevention": {
        "e8": "Patch applications",
        "ism": "System patching"
      },
      "sourceKind": "kev",
      "cves": [
        "CVE-2026-116779"
      ],
      "links": [
        {
          "label": "CISA KEV: FreeSWITCH flaw",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-116779"
        },
        {
          "label": "FreeSWITCH security advisory",
          "url": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p"
        }
      ],
      "cwes": [
        "CWE-77",
        "CWE-78",
        "CWE-749"
      ]
    }
  ]
}